Cybersecurity daily — 29 October 2026: verify that Brotli patches are active
AWS details Brotli mitigation: phased Lambda rollout, Node.js 24 verification, container rebuilds and upstream-response decoding.
Текст статьи на этом языке недоступен; показывается английский.
Window: 28 October 2026 08:00 to 29 October 2026 08:00 JST. One material new primary-source update was selected: cloud mitigation and verification details for the known Brotli issue, not a newly discovered vulnerability. The focus moves from authorization products to evidence that runtime patches are actually active.
## AWS: a runtime update is not automatically a completed deployment
AWS published its CVE-2026-111497 status on 28 October at 15:00 PDT (29 October 07:00 JST). Crafted Brotli input can corrupt memory, disclose data or execute code during decompression. Node.js published its fix on 21 October; that is not today's discovery. External HTTP responses and compressed data fetched by agents are potential inputs when the application decodes them.
Post-cutoff source note: AWS last updated the linked bulletin on 29 October at 14:00 PDT (30 October 06:00 JST), after this daily’s cutoff. The following runtime and mitigation details are based on that updated bulletin; their presence in the original publication has not been independently verified. What changed: AWS distinguishes the unaffected Lambda managed service from affected Node.js/.NET runtimes, and updated container base images from customer rebuilds and redeployments. ZIP runtime deployment is phased by region. A target date is not proof that every environment has been updated.
Actions: customer-managed Node.js requires an appropriate supported release containing the fixes introduced in 22.23.4, 24.22.1 and 26.12.1. Rebuild containers from patched bases and inventory Brotli bundled in functions and layers. Lambda Node.js 24 receives a targeted patch to avoid a regression, so process.version alone cannot prove remediation. AWS directs users to cold-start INIT_START records: nodejs:22.mainline.v157 or newer for 22, and nodejs:24.mainline.v114 or newer for 24.
Threat-model implication: a WAF rule blocking inbound Content-Encoding: br does not protect decompression of upstream responses. Identify which process decodes data on each agent/MCP retrieval path, and consider disabling affected decoding where no patch is available. The reviewed primary sources do not report in-the-wild exploitation; silence does not establish absence.
Primary sources: [AWS status, 28 October PDT](https://aws.amazon.com/security/security-bulletins/2026-155-aws/) / [Node.js fixes, 21 October](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Separate rollout targets from observed active versions.
## Decisions
Act now: inventory Brotli decoding in agents, MCP services and containers, patch and verify active runtimes. Validate: upstream-response decoding paths, actual ZIP updates and residual bundled libraries. Watch: AWS deployment status and patches in other implementations. No new primary-source development changing architecture decisions in passkeys, TEE or capability authorization was verified in this search.